njrat | 8a2e1a0ade05db6ef7fdc307b058119e7d84c26b7a75495a4348e310d67f15e7

General

Target

834e38185fb19b1adf58cc82aaf73e1e.exe
Size

399KB
MD5

834e38185fb19b1adf58cc82aaf73e1e
SHA1

2a3bca9b936093f82a1be92737012e683a863a6a
SHA256

8a2e1a0ade05db6ef7fdc307b058119e7d84c26b7a75495a4348e310d67f15e7
SHA512

4fe755a20fcbf6ac5c1f4993489a9c00306908f4497d11d1d260aad6bf26dbb7cd7b86e14d0d15f2546267df8cd19b2765405a1ee446d8bd316aa11201f1e7c9

Score

10^/10

njrat ------(send)------trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

------(Send)------

C2

new.libya2020.com.ly:2020

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 1 IoCs

Processes:

834e38185fb19b1adf58cc82aaf73e1e.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	834e38185fb19b1adf58cc82aaf73e1e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

834e38185fb19b1adf58cc82aaf73e1e.exe

description pid process target process

PID 528 set thread context of 1396 528 834e38185fb19b1adf58cc82aaf73e1e.exe 834e38185fb19b1adf58cc82aaf73e1e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1328 schtasks.exe

description	pid	process	target process
PID 528 set thread context of 1396	528	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe

pid	process
1328	schtasks.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

834e38185fb19b1adf58cc82aaf73e1e.exe

description	pid	process
Token: SeDebugPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	1396	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	1396	834e38185fb19b1adf58cc82aaf73e1e.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

834e38185fb19b1adf58cc82aaf73e1e.exe

description	pid	process	target process
PID 528 wrote to memory of 1328	528	834e38185fb19b1adf58cc82aaf73e1e.exe	schtasks.exe
PID 528 wrote to memory of 1328	528	834e38185fb19b1adf58cc82aaf73e1e.exe	schtasks.exe
PID 528 wrote to memory of 1328	528	834e38185fb19b1adf58cc82aaf73e1e.exe	schtasks.exe
PID 528 wrote to memory of 1328	528	834e38185fb19b1adf58cc82aaf73e1e.exe	schtasks.exe
PID 528 wrote to memory of 1396	528	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 528 wrote to memory of 1396	528	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 528 wrote to memory of 1396	528	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 528 wrote to memory of 1396	528	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 528 wrote to memory of 1396	528	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 528 wrote to memory of 1396	528	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 528 wrote to memory of 1396	528	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 528 wrote to memory of 1396	528	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 528 wrote to memory of 1396	528	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe

C:\Users\Admin\AppData\Local\Temp\834e38185fb19b1adf58cc82aaf73e1e.exe
"C:\Users\Admin\AppData\Local\Temp\834e38185fb19b1adf58cc82aaf73e1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dRjlsmRl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE917.tmp"
2⤵
- Creates scheduled task(s)
PID:1328

C:\Users\Admin\AppData\Local\Temp\834e38185fb19b1adf58cc82aaf73e1e.exe
"C:\Users\Admin\AppData\Local\Temp\834e38185fb19b1adf58cc82aaf73e1e.exe"
2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/528-54-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download
memory/528-56-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/528-57-0x0000000000550000-0x0000000000557000-memory.dmp

Filesize
28KB

Download
memory/528-58-0x0000000000E30000-0x0000000000E59000-memory.dmp

Filesize
164KB

Download
memory/1328-59-0x0000000000000000-mapping.dmp

Download
memory/1396-60-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1396-61-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1396-62-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1396-63-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1396-64-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1396-65-0x000000000040839E-mapping.dmp

Download
memory/1396-66-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1396-68-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1396-69-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads